Skip to content
HANU
Deploy Hanu
Menu

By role

Regulated and sovereignty-bound

Data residency rules are not satisfied by a data-processing addendum. They are satisfied when the telemetry, the datastores and the keys are all inside a boundary you control and can prove.

data residency security platformair-gapped security platformself-hosted compliance evidence

What changes

The whole platform runs inside your boundary, including the datastores and the artefacts, with no outbound calls and evidence generated from live findings rather than gathered by hand.

"In your cloud" has to include the datastores

Findings in your Postgres, the attack graph in your Neo4j, artefacts in your object store. There is no relay, no telemetry endpoint and no licence server in the image — which is a claim an assessor can verify by watching network egress.

Attestation honesty

The platform ships framework evidence engines for SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, NIST 800 and the EU AI Act. A SOC 2 report exists for the managed edition; self-hosted customers rely on their own controls and this platform's audit trail. We say which is which rather than blurring it.

Third-party trust is part of your boundary

Certificate authorities are tracked as supply-chain dependencies. When a public CA's intermediate keys become recoverable, as happened with eMudhra's emSign hierarchy in October 2026, the certificates you issued through that hierarchy are findable in your own inventory.

A reasonable first fortnight

Not a migration plan — the first two weeks, in the order that produces something useful fastest.

  1. Decide the boundary: namespace, VPC and KMS key, and record it as the scope for your next assessment.
  2. Enable the framework evidence engines for your obligations and map each control to the findings that satisfy it.
  3. Configure retention for the per-tenant audit log to match your longest audit obligation.
  4. Verify egress is zero with your own network tooling before you tell an auditor that it is.

Questions this role tends to ask

Can it run with no outbound internet access?
Yes. The application image runs read-only and needs no external service. The detection feed is a signed bundle that can be copied in, and the datastores, artefacts and keys are all in your boundary. Verify egress with your own tooling before you tell an assessor it is zero.
Where is the audit log and how is it protected?
Per tenant, hash-chained, and stored in your Postgres or your object store, with source credentials sealed by your own KMS. Be precise with your auditor about what that gives you: the chain makes tampering evident within the log, and independent verification tooling is something you run yourself.
Is the product SOC 2 certified?
The self-hosted edition is not, and we will not imply otherwise. A SOC 2 report is available for the managed edition, and for the self-hosted edition the relevant attestation is your own control environment. The platform supplies the evidence engines and the audit trail that support it.
Does it help with India-specific obligations?
It tracks certificate authorities as supply-chain dependencies, including the eMudhra emSign hierarchy whose intermediate keys became recoverable in October 2026 — so certificates issued through a specific public CA are queryable inventory. Framework evidence engines cover the common global frameworks; DPDP obligations map to your own control set.

What it is not

Hanu is not a SIEM and does not try to be one — it correlates and hands the result to the response process you already run. It is not a certified SOC 2 Type II service for self-hosted customers; the evidence engines and audit trail support your own controls. And it does not cover Oracle Cloud, which exists in the codebase as stubs only.

Run it in your own account

One Docker Compose stack, your datastores, read-only credentials into your clouds. The Community edition is free to run in production.

Deploy HanuSee what is paid